Debian DLA-2312-1 : libx11 security update

Todd Carson discovered some integer overflows in libX11, which could lead to heap corruption when processing crafted messages from an input method. For Debian 9 stretch, this problem has been fixed in version 2:1.6.4-3+deb9u2. We recommend that you upgrade your libx11 packages. For the detailed...

Debian DLA-2307-1 : ruby-zip security update

rubyzip gem version 1.2.1 and earlier contains a Directory Traversal vulnerability in Zip::File component that can result in write arbitrary files to the filesystem. This attack appear to be exploitable via if a site allows uploading of .zip files, an attacker can upload a malicious file that...

Debian DLA-2306-1 : libphp-phpmailer security update

It was discovered that there was an escaping issue in libphp-phpmailer, an email generation utility class for the PHP programming language. The Content-Type and Content-Disposition headers could have permitted file attachments that bypassed attachment filters which match on filename extensions. F...

Debian DLA-2303-1 : libssh security update

The code in src/sftpserver.c did not verify the validity of certain pointers and expected them to be valid. A NULL pointer dereference could have been occurred that typically causes a crash and thus a denial of service. For Debian 9 stretch, this problem has been fixed in version 0.7.3-2+deb9u3. ...

Debian DLA-2305-1 : transmission security update

Use-after-free in libtransmission/variant.c in Transmission before 3.00 allows remote attackers to cause a denial of service crash or possibly execute arbitrary code via a crafted torrent file. For Debian 9 stretch, this problem has been fixed in version 2.92-2+deb9u2. We recommend that you upgra...

Debian DLA-2304-1 : libpam-radius-auth security update

addpassword in pamradiusauth.c in pamradius 1.4.0 does not correctly check the length of the input password, and is vulnerable to a stack-based buffer overflow during memcpy. An attacker could send a crafted password to an application loading the pamradius library and crash it. Arbitrary code...

Debian DLA-2309-1 : evolution-data-server security update

In Evolution Data Server a vulnerability was discovered that allowed a malicious server to crash the mail client. For Debian 9 stretch, this problem has been fixed in version 3.22.7-1+deb9u2. We recommend that you upgrade your evolution-data-server packages. For the detailed security status of...

[SECURITY] [DLA 2301-1] json-c security update

------------------------------------------------------------------------- Debian LTS Advisory DLA-2301-1 [email protected] https://www.debian.org/lts/security/ Emilio Pozuelo Monfort July 30, 2020 https://wiki.debian.org/LTS -...

Debian DLA-2297-1 : firefox-esr security update

Multiple security issues have been found in the Mozilla Firefox web browser, which could potentially result in the execution of arbitrary code. For Debian 9 stretch, these problems have been fixed in version 68.11.0esr-1deb9u1. We recommend that you upgrade your firefox-esr packages. For the...

[SECURITY] [DSA 4736-1] firefox-esr security update

------------------------------------------------------------------------- Debian Security Advisory DSA-4736-1 [email protected] https://www.debian.org/security/ Moritz Muehlenhoff July 29, 2020 https://www.debian.org/security/faq -...

[SECURITY] [DLA 2297-1] firefox-esr security update

------------------------------------------------------------------------- Debian LTS Advisory DLA-2297-1 [email protected] https://www.debian.org/lts/security/ Emilio Pozuelo Monfort July 29, 2020 https://wiki.debian.org/LTS -...

[SECURITY] [DLA 2291-1] ffmpeg security update

Debian LTS Advisory DLA-2291-1 [email protected] https://www.debian.org/lts/security/ July 27, 2020 https://wiki.debian.org/LTS Package : ffmpeg Version : 7:3.2.15-0+deb9u1 CVE ID : CVE-2019-13390 CVE-2019-17542 CVE-2020-13904 Debian Bug : Several vulnerabilities have been fixed by...

Debian DLA-2290-1 : e2fsprogs security update

An issue has been found in e2fsprogs, a package that contains ext2/ext3/ext4 file system utilities. A specially crafted ext4 directory can cause an out-of-bounds write on the stack, resulting in code execution. An attacker can corrupt a partition to trigger this vulnerability. For Debian 9 stretc...

Debian DLA-2289-1 : mupdf security update

Several issues have been found in mupdf, a lightweight PDF viewer. The issues could be exploited by crafted PDF files that result in denial of service by heap-based buffer overflows, segmentation faults or out of bound reads. For Debian 9 stretch, these problems have been fixed in version...

Debian DLA-2284-1 : ksh security update

A flaw was found in the way it evaluates certain environment variables. An attacker could use this flaw to override or bypass environment restrictions to execute shell commands. Services and applications that allow remote unauthenticated attackers to provide one of those environment variables cou...

Debian DLA-2275-1 : ruby-rack security update

The following CVEs were reported against src:ruby-rack. CVE-2020-8161 A directory traversal vulnerability exists in rack 2.2.0 that allows an attacker perform directory traversal vulnerability in the Rack::Directory app that is bundled with Rack which could result in information disclosure...

Debian DLA-2278-3 : squid3 regression update

The update of squid3 released as DLA-2278-2 introduced a regression due to the updated fix for CVE-2019-12529. The new Kerberos authentication code prevented base64 token negotiation. Updated squid3 packages are now available to correct this issue. For Debian 9 stretch, this problem has been fixe...

[SECURITY] [DSA 4719-1] php7.3 security update

------------------------------------------------------------------------- Debian Security Advisory DSA-4719-1 [email protected] https://www.debian.org/security/ Salvatore Bonaccorso July 06, 2020 https://www.debian.org/security/faq -...

[SECURITY] [DSA 4692-1] netqmail security update

------------------------------------------------------------------------- Debian Security Advisory DSA-4692-1 [email protected] https://www.debian.org/security/ Salvatore Bonaccorso May 24, 2020 https://www.debian.org/security/faq -...

[SECURITY] [DSA 4692-1] netqmail security update

------------------------------------------------------------------------- Debian Security Advisory DSA-4692-1 [email protected] https://www.debian.org/security/ Salvatore Bonaccorso May 24, 2020 https://www.debian.org/security/faq -...